PT-2018-16136 · Serve · Serve

Bl4De + 1 · Publicado 2018-06-07 · Atualizado 2019-10-09 · CVE-2018-3712

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions serve versions prior to 6.4.9

Description The issue arises from the software's failure to properly handle %2e (.) and %2f (/) characters in paths, allowing a malicious user to traverse the directory tree and list the contents of any directory the user running the process has access to. This vulnerability only allows listing of directory contents and does not allow reading of arbitrary files.

Recommendations Update to version 6.4.9 or later.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-3712

GHSA-Q2QH-CGC2-QHR3

Produtos afetados

Serve

Referências · 7

• 🔥 https://hackerone.com/reports/307666 · Exploit
• https://github.com/zeit/serve/pull/316 · Aviso do Fabricante
• https://github.com/vercel/serve/commit/6adad6881c61991da61ebc857857c53409544575 · Nota
• https://github.com/vercel/serve · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-3712 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-3712 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-q2qh-cgc2-qhr3 · Aviso do Fabricante